CVE-2024-53990
Critical
Description
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When making any HTTP request, the automatically enabled and self-managed CookieStore (aka cookie jar) will silently replace explicitly defined Cookies with any that have the same name from the cookie jar. For services that operate with multiple users, this can result in one user's Cookie being used for another user's requests.
SeverityCritical
CVSS9.2
Exploit probability—
ProductOrg.asynchttpclient:async-http-client
PublishedDec 2, 2024
First seenDec 2, 2024
Weakness typeCWE-287Improper authentication
How to fix
Update
- org.asynchttpclient:async-http-client2.12.4, 3.0.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.asynchttpclient:async-http-clientMaven | 2.1.0 ≤ v < 2.12.4, 3.0.0.Beta1 ≤ v < 3.0.1 | 2.12.4, 3.0.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.